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Notice of Allowability 


Application No. 
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Applicant(s) 

OSBORN, KEVIN G. 


Examiner 
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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address— 
All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1 308. 

1 . ^ This communication is responsive to 21 November 2008 . 

2. ^ The allowed claim(s) is/are 1-4.7-9.13.14.30 and 33 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a)n All b)nSome* c) □ None of the: 

1. n Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) O including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) O including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 
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1 . □ Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. □ Information Disclosure Statements (PTO/SB/08), 

Paper No./Mail Date 

4. O Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application 

6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

7. S Examiner's Amendment/Comment 

8. ^ Examiner's Statement of Reasons for Allowance 

9. □ Other . 
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DETAILED ACTION 

1 . The Applicant's amendment, filed 21 November 2008, has been received and entered into 
the record, respectfully and carefully considered. 

2. As a result of the amendment, claims 6, 15-29, 31-32 and 34 are canceled. Therefore, 
claims 1-5, 7-14, 30 and 33 have been examined. 

Claim Rejections - 35 USC § 101 

3. As a result of canceling claims 1 7-21 , 23-29 and 32, the examiner withdraws the pending 
101 rejections to claims 17-21, 23-29 and 32. 

EXAMINER'S AMENDMENT 

4. An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1 .312. 
To ensure consideration of such an amendment, it MUST be submitted no later than the payment 
of the issue fee. Authorization for this examiner's amendment was given in a telephone interview 
with Mr. Jeremy Curcuri (Registration No. 42,454) on 14 January 2009 and 23 January 2009. The 
amendment is to overcome minor informalities and to further clarify the invention. As per MPEP 
713.04, a separate interview summary form is not provided because the content of the interview 
has been summarized herein. 

The application has been amended as follows: 
IN THE CLAIMS: 

> Please cancel claims 5, 10, 11 and 12 

> Please amend claims 1,13 and 30 as below: 
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(Claim 1) (Currently Amended) A method of tracking incoming transmissions comprising: 

identifying an incoming transmission including at least one identifiable portion; 

computing, for each identifiable portion in the incoming transmission, a fingerprint 
Indicative of the at least one identified portion, the fingerprint being substantially unique to the at 
least one Identified portion; 

storing the computed fingerprint to generate a set of stored fingerprints in a 
hardware Implemented mall server : 

receiving at the hardware implemented mail server a set of comparison fingerprints 
corresponding to a known portion of the incoming transmission, the set of comparison fingerprints 
being predetermined; 

comparing at the hardware implemented mail server the set of stored fingerprints to 
the set of comparison fingerprints to Identify stored fingerprints matching at least one of the set of 
comparison fingerprints and, If a match Is found, Identifying a previous Incoming transmission 
corresponding to a matching stored fingerprint of the set of stored fingerprints; 

storing an indication of a subsequent disposition of the incoming transmission in the 
hardware implemented mail server : 

receiving at the hardware implemented mail server a subsequent set of comparison 
fingerprints, the subsequent set of comparison fingerprints indicative of refinements to the known 
portion of the Incoming transmission; 

matching the subsequent set of comparison fingerprints to the stored fingerprints at 
the hardware implemented mail server : 

determining, based on the matching of the subsequent set of comparison 
fingerprints, if the subsequent set of comparison fingerprints is indicative of an undesirable portion 
In the incoming transmission at the hardware implemented mail server : aR4 

selectively performing, based on the determining, a remedial action In response to 
the subsequent disposition at the hardware Implemented mall server: 

wherein the set of comparison fingerprints are virus signatures computed from known 

undesirable transactions: 

demarcating the incoming transmission into segments at the hardware implemented 

mail server, each segment operable to yield a fingerprint, wherein the comparing further comprises 
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comparing each value in the set of comparison fingerprints with at least one of the segments at the 
hardware implemented mail server : 

identifying a segment type of each segment, the segment type corresponding to the 
content included in the segment: 

categorizing each of the segments according to a heuristic, the heuristic indicative of 

a likelihood of the categorized segment including an undesirable transmission: 
identifying a hsk assessment of each of the segment types: and 

storing the segment according to the identified risk assessment, storing further 

including identifying a duration . 



(Claim 13) (Currently Amended) The method of claim [[12]] 1 wherein storing the segments 
further comprises storing the content of the segment with the corresponding fingerprint. 

(Claim 30) (Currently Amended) A comput e r program product hav i ng a comput e r r e adab l e 
m e d i um operab le to stor e comput e r program l og i c e mbod ie d i n comput e r program cod e e ncod e d 
ther e on for track i ng i ncom i ng transm i ss i ons compr i s i ng: 

A computer program stored in a computer readable storage medium to execute a 
method of tracking incoming transmissions, said method comprising the steps of: 

comput e r program code for identifying an incoming transmission including at least 
one identifiable portion; 

comput e r program cod e for computing, for each identifiable portion in the incoming 
transmission, a fingerprint indicative of the at least one identified portion, the fingerprint being 
substantially unique to the at least one identified portion; 

comput e r program cod e for storing the computer fingerprint to generate a set of 
stored fingerprints; 

comput e r program cod e for receiving a set of comparison fingerprints corresponding 
to known portion of the incoming transmission, the set of comparison fingerprints being 
predetermined; 
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comput e r program cod e for comparing tine set of stored fingerprints to the set of 
comparison fingerprints to identify stored fingerprints matcliing any of tine set of comparison 
fingerprints and, if a match is found, identifying a previously received incoming transmission 
corresponding to a matching stored fingerprint of the set of stored fingerprints; 

comput e r program cod e for storing an indication of a subsequent disposition of the 
incoming transmission; 

comput e r program cod e for receiving a subsequent set of comparison fingerprints, 
the subsequent set of comparison fingerprints indicative of refinements to the l<nown portion of the 
incoming transmission; 

comput e r program cod e for matching the subsequent set of comparison fingerprints 
to the stored fingerprints; 

comput e r program cod e for determining, based on the matching of the subsequent 
set of comparison fingerprints, if the subsequent set of comparison fingerprints is indicative of an 
undesirable portion in the incoming transmission; aFi4 

comput e r program cod e for selectively performing, based on the determining, a 
remedial action in response to the subsequent disposition; 

wherein the set of comparison fingerprints are virus signatures computed from known 

undesirable transactions: 

demarcating the incoming transmission into segments, each segment operable to 

yield a fingerprint, wherein comparing further comprises comparing each value in the set of 
comparison fingerprints with at least one of the segments : 

identifying a segment type of each segment, the segment type corresponding to the 

content included in the segment: 

categorizing each of the segments according to a heuristic, the heuristic indicative of 

a likelihood of the categorized segment including an undesirable transmission: 

identifying a risk assessment of each of the segment types: and 

storing the segment according to the identified risk assessment, storing further 

including identifying a duration . 
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Reason for Allowance 

5. The following is the Examiner's statement of reasons for allowance: 

The prior art does not teach the limitations in independent claims 1 and 30. The closest 
prior art fails to disclose wherein the set of comparison fingerprints are virus signatures computed 
from known undesirable transactions, demarcating the incoming transmission into segments, each 
segment operable to yield a fingerprint, wherein comparing further comprises comparing each 
value in the set of comparison fingerprints with at least one of the segments, identifying a segment 
type of each segment, the segment type corresponding to the content included in the segment; 
categorizing each of the segments according to a heuristic, the heuristic indicative of a likelihood of 
the categorized segment including an undesirable transmission; identifying a risk assessment of 
each of the segment types; storing the segment according to the identified risk assessment, storing 
further including identifying a duration and in combination with all other claim limitations in the 
claims. 

The examiner further notes in pages 4-6 of the original disclosure, the Applicant discloses 
"A mail server stores... The mail server subsequently receives... The mail server comparing. ..the 
mail server receives... The mail server demarcates... The invention... implemented on a computer 
having a processor, memory, and interface operable for the performing the steps and methods. ..as 
disclosed herein. ..computerized device such as. ..central processing unit, microprocessor... or other 
hardware device configured to process all the of the method operations disclosed herein". A new 
limitation of "in/at the hardware implemented mail server" is added to claim 1 in the above 
authorized examiner's amendment based on the above cited passage from the original disclosure. 
Therefore, claims 1-4, 7-9, 13-14 and 33 have a specific machine tied in the method claims and 
they are statutory. 

Furthermore, the examiner notes in the amendment to the specification submitted 06 
December 2007, in which the Applicant deletes "or c) information conveyed to a computer through 
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communication media, for example using baseband signaling or broadband signaling technique, as 
In an electronic network such as the Internet or telephone modem lines. The operations and 
methods maybe implemented in a software executable object or as a set of instructions embedded 
in a carrier wave" from page 16 of the original disclosure. Thus, the examiner takes the act of 
deleting as a disavowal. Additionally, on page 16 of the original disclosure, the Applicant discloses 
"ROM devices. ..floppy disks. ..CDs. ..RAM devices...". It is clear that to an ordinary skill in the art 
ROM devices, floppy disks, CD and RAM devices are computer readable storage medium. 
Therefore, claim 30 is statutory. 

Allowable Subject Matter 
6. Claims 1-4, 7-9, 13-14, 30 and 33 are allowed. 

Contact Information 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to APRIL Y. SHAN whose telephone number is (571 )270-1014. The examiner 
can normally be reached on Monday - Friday, 8:00 a.m. - 5:00 p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Kim Y. Vu can be reached on (571 ) 272-3859. The fax phone number for the organization where 
this application or proceeding is assigned is 571-273-8300. 
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Information regarding tine status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications may 
be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, 
contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like 
assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/April Y Shan/ 
Examiner, Art Unit 2435 

/Kimyen Vu/ 

Supervisory Patent Examiner, Art Unit 2435 



